Looks like it is possible to set "Send email as" to a custom email address that would appear in the From field in scheduled alerts/reports. However, this would take effect across the board and we have different teams that would like to use their group emails for their alerts/reports. Is it possible to set different "Send email as" to different alerts/reports?
I believe you can set the action.email.from =
for each saved search/alert level. See if that's available for update from Splunk Web UI in advanced edit on Searches, reports and alerts.
Sure, if you use the sendemail
command inline on the search. For example:
index=myindex | head 10 | sendemail to=recipient@test.com from=sender@test.com
BTW, you can read about the whole list of options available with the sendemail
command here:
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Sendemail
Thank you very much for your suggestion. However, I am looking at "Schedule PDF Delivery" where the Dashboard can be sent as a PDF attachment to an email. And also regular scheduled Alerts.
Ahh, in that case, then I think @somesoni2 is on the right track for helping you in his comment above!